Privacy Policy
Information about the processing of personal data of people who use digicyfr.com or contact CYFR Sp. z o.o.
Effective date: 25 September 2026
This is a translation. If it differs from the Polish version, the Polish version prevails.
Contents
1. Data controller
The controller is CYFR SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office at ul. Admiralska 10, unit 1, 00-910 Warsaw, Poland, KRS 0001266161, NIP 9522289731, operating under the Digicyfr brand.
For privacy matters, contact info@digicyfr.com, +48 695 021 633, or write to the registered address. The company has not appointed a Data Protection Officer.
2. Data we process
- form data: name, email address, telephone number, business type and stage, preferred language and message;
- information contained in later correspondence, proposals and business arrangements;
- technical data: IP address, browser/device type, timestamps, requested URL, security logs, error data and Turnstile verification result;
- the selected language saved in a browser cookie.
3. Purposes and legal bases
| Purpose | Legal basis | Data |
|---|---|---|
| Replying to an enquiry and preparing a proposed engagement | GDPR Article 6(1)(b) — steps before entering into a contract | form data and correspondence |
| Business correspondence, documenting arrangements and legal claims | GDPR Article 6(1)(f) — legitimate interests | contact details, content and message metadata |
| Security, abuse prevention and error diagnostics | GDPR Article 6(1)(f) — secure and reliable services | technical data and logs |
| Tax, accounting or other legal duties after an engagement begins | GDPR Article 6(1)(c) | data required by applicable law |
- Purpose
- Replying to an enquiry and preparing a proposed engagement
- Legal basis
- GDPR Article 6(1)(b) — steps before entering into a contract
- Data
- form data and correspondence
- Purpose
- Business correspondence, documenting arrangements and legal claims
- Legal basis
- GDPR Article 6(1)(f) — legitimate interests
- Data
- contact details, content and message metadata
- Purpose
- Security, abuse prevention and error diagnostics
- Legal basis
- GDPR Article 6(1)(f) — secure and reliable services
- Data
- technical data and logs
- Purpose
- Tax, accounting or other legal duties after an engagement begins
- Legal basis
- GDPR Article 6(1)(c)
- Data
- data required by applicable law
We do not rely on mandatory consent to answer an enquiry. Providing data is voluntary, but we cannot handle the form without fields marked as required.
4. Recipients and providers
| Provider | Role | Possible data |
|---|---|---|
| Vercel | website hosting, content delivery and technical logs | technical data, including IP address and request information |
| Cloudflare Turnstile | protecting forms against automated abuse | IP address, device/browser data and verification result |
| Resend | sending a form submission by email | the details and message submitted through the form |
| Zoho Mail | receiving and handling correspondence | contact details, correspondence content and message metadata |
| Sentry | error detection, security and performance diagnostics | technical error data; form contents are not intentionally sent |
- Provider
- Vercel
- Role
- website hosting, content delivery and technical logs
- Possible data
- technical data, including IP address and request information
- Provider
- Cloudflare Turnstile
- Role
- protecting forms against automated abuse
- Possible data
- IP address, device/browser data and verification result
- Provider
- Resend
- Role
- sending a form submission by email
- Possible data
- the details and message submitted through the form
- Provider
- Zoho Mail
- Role
- receiving and handling correspondence
- Possible data
- contact details, correspondence content and message metadata
- Provider
- Sentry
- Role
- error detection, security and performance diagnostics
- Possible data
- technical error data; form contents are not intentionally sent
Authorised personnel, legal or accounting advisers and public authorities may also receive data where justified or required by law. We do not sell personal data.
5. Transfers outside the EEA
Some providers may process data outside the European Economic Area. Depending on the provider and processing location, transfers rely on an adequacy decision, the EU–US Data Privacy Framework or European Commission Standard Contractual Clauses. Information about the relevant safeguard is available from info@digicyfr.com.
6. Retention
- enquiries that do not lead to an engagement: up to 12 months after the last contact;
- contract-related data: throughout delivery and afterwards for the period required by law or needed to establish, pursue or defend claims;
- tax and accounting records: for the period required by applicable law;
- security, anti-abuse and diagnostic logs: according to the provider’s applicable period and no longer than necessary for security and diagnostics;
- browser storage: until the period in the Cookie Policy expires or the user deletes it.
7. Your rights
Depending on the legal basis and circumstances, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing exceptionally relies on consent, consent may be withdrawn without affecting earlier lawful processing.
Send requests to info@digicyfr.com. You may also complain to the President of the Polish Personal Data Protection Office (UODO).
8. Automated decisions and changes
We do not make solely automated decisions about website users and do not conduct profiling with legal or similarly significant effects. We may update this policy when the law, providers or website operation changes. The new version will display its effective date.